CVE-2017-7660
It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 5.63% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- apache/solr
- Source
- security@apache.org
References
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme-Z%3Dg%40mail.gmail.com%3EMailing List, Vendor Advisory
- http://www.securityfocus.com/bid/99485Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20181127-0003/
- http://mail-archives.us.apache.org/mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme-Z%3Dg%40mail.gmail.com%3EMailing List, Vendor Advisory
- http://www.securityfocus.com/bid/99485Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20181127-0003/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.